Is there such a thing as ‘my information’? In today’s digital age, safeguarding personal data is essential; Particularly in the insurance and financial services industries due to the nature of information clients share with these companies. Financial institutions are privy to personal identification information, health records, financial information among others.
The right to privacy is a fundamental one that is protected under the Constitution of Uganda. In Uganda, the Data Protection and Privacy Act, of 2019 gives effect to Article 27 of the 1995 Constitution which guarantees the right to privacy. However, true data privacy goes beyond mere compliance; it requires cultivating a culture of privacy within organisations.
Treating data privacy as a cultural value rather than a regulatory requirement to avoid penalties, differentiates companies in a competitive market, reduces operational risks, and builds long-term trust with customers. Traditionally, many organisations focused on meeting minimum regulatory requirements, addressing data privacy only when forced by audits, legal actions, or incidents such as data breaches. This approach often leads to gaps in processes, higher risks of non-compliance, and a lack of trust among customers.
An article by Tier Data, a Kenya Information Services Consultancy company recently highlighted examples of data privacy violations by African companies. One notable case involved a reputable company which was ordered to pay 1.95 million Kenyan shillings (approximately £11,600) in damages for mishandling the personal information of its former CEO. The company accessed the CEO’s laptop and personal data without his consent during an internal investigation, violating Kenya's Data Protection Act. This case illustrates that a lapse in data privacy can have severe consequences, including reputational damage, financial loss, and loss of customer trust. In the modern landscape, data protection must evolve from being a reactive, regulatory checkbox to a proactive, integral part of organisational culture.
Data breaches directly affect the individual and cause immeasurable and extensive harm to all parties involved. A 2021 article from Daily Monitor revealed a service company in Uganda, was found to have shared users' personal data (names, phone numbers, email addresses, and potentially location data) with a third party. Users were not properly informed about how their data would be used or shared, leading to a breach of their privacy. This shared location data, combined with personal contact information could be exploited for stalking, harassment, or other malicious activities. This case was investigated by Uganda’s National Information Technology Authority (NITA-U) following a complaint by a user. This case highlighted the importance of informed consent in data handling and the need for companies to comply with data protection laws to avoid harming individuals and losing user trust.
A proactive stance, on the other hand, integrates data privacy into daily operations, making it integral in the company’s values. This involves regular risk assessments, continuously evaluating systems and processes for vulnerabilities, ongoing training, and ensuring employees at all levels understand their role in protecting personal data. Employees are the first line of defense against data breaches. A single mistake, such as falling for a phishing email, can compromise sensitive data.
Additionally, embedding privacy by design is another key step in adopting a data privacy culture in any organisation. Privacy by design is a principle that integrates privacy measures into every aspect of business processes, from inception to execution. This is broken down to consider 3 key areas which include product development, service delivery and data management. During the design phase of any new products, privacy considerations must be addressed by embedding secure data processing and storage mechanisms from the start whilst collecting only the necessary data. Privacy must also be maintained throughout the customer journey through transparent communication and the implementation of secure communication channels with the company’s clientele.
It is important to note that leadership sets the tone for organisational culture. When executives prioritize data privacy, it signals its importance across the organisation. Executives should lead by example and actively participate in privacy training, including data privacy as a key agenda in leadership meetings and organisational planning. Leaders should also strive to adhere to the same standards expected of employees. Robust technology solutions are also essential in securing personal data against cyber threats. Companies must adopt encryption, implement systems that monitor and respond to unauthorized access attempts in real time. Additionally, organisations need to regularly update and patch software to protect against evolving threats, conduct regular penetration testing to identify and address vulnerabilities and invest in cloud and on-premises solutions with strong security protocols such as multi-factor authentication (MFA) and role-based access controls.
UAP Old Mutual has successfully implemented a culture of data privacy, and comprehensive data protection measures, as mentioned above. These practices have enhanced customer trust and ensured compliance with international data protection regulations.
To address emerging risks and capitalize on technological advancements, companies must focus on continuous improvement in data privacy practices. There needs to be regular reviews and updates for data privacy policies to align with technological advancements and changing regulatory landscapes. The future of data privacy in Uganda will be shaped by the interplay between innovative technologies and robust privacy frameworks. While AI, big data, and Internet of Things (IoT) offer transformative opportunities, they also necessitate heightened vigilance and adaptability. Prioritizing continuous improvement, fostering collaboration, and placing customer trust at the core, enables companies to navigate this evolving landscape successfully and sustainably.
As we celebrate data privacy week (27-31 January), the responsibility for fostering a robust data privacy culture cannot rest solely on individual organisations. It requires collective action by all stakeholders in the ecosystem including insurers, regulators, technology providers, and customers. Together, these players must champion data privacy as a shared responsibility, advocating for transparency, accountability, and innovation to address emerging risks.